CyberSpooon

Incident Responder. I also like lifting and coffee.

[CyberSpooon @CyberSpooon]

Observed this in our environment the other day. The phishing link obfuscation using google translate is interesting. Basically adding your phishing url (reddit in this case) ie https://t.co/61UxVC6xpl can bypass email filtering since the TLD is .goog and likely considered "safe"

[CyberSpooon @CyberSpooon]

Also saw this in the wild. Also TIL. Advanced IP Scanner saves most recently scanned IP range in registry.

[The DFIR Report @TheDFIRReport]

"Checking the registry and network traffic, we could identify ranges they scanned. They most likely ran several scans in Advanced IP scanner. We found evidence of scans for private IP ranges as well as multiple public IP ranges belonging to Microsoft and other entities..."

[CyberSpooon @CyberSpooon]

Saw this in the wild and started digging. TIL

[Stephan Berger @malmoeb]

What I learnt today:

When NetScan is executed with the ‘Check for write access’ option enabled, a ‘delete[.]me’ file is created then deleted on discovered shares. [1]

Thanks, The DFIR Report - this is exactly what we are seeing in a recent case. I owe you one 🍻

[1] https://t.co/RcfTnnxoZy

[CyberSpooon @CyberSpooon]

@GrahamHelton3 @DistrictCon DistrictCon gang 🤘🏻

[CyberSpooon @CyberSpooon]

@vxunderground Can’t wait till they add the freemium tier where u have to watch 30 seconds of ads before u can use ur car

[CyberSpooon @CyberSpooon]

@0xEnleak Ooh ok rad Ty. I forgot there is an Eric Zimmerman tool for MFT stuff. Will try that next sherlock ty 🤘🏻

[CyberSpooon @CyberSpooon]

@TG01_Actual @vxunderground My thoughts as well. Or they really hate Florida which is valid

[CyberSpooon @CyberSpooon]

Brooooo what is going on 🤯😂😂

[CyberSpooon @CyberSpooon]

Finished my second write-up for Wiz’s cloud security CTF. Any critiques and feedback on the post would be much appreciated! 🤘🏻

https://t.co/zHN0csbgnx

[CyberSpooon @CyberSpooon]

Stoked to be going to DistrictCon🤘🏻

[DistrictCon @DistrictCon]

Tickets on sale NOW!
https://t.co/TTEfOcX91J

[CyberSpooon @CyberSpooon]

@jackfriks

[CyberSpooon @CyberSpooon]

@0xEnleak YES IT WAS 😂😂😂😂😂

[CyberSpooon @CyberSpooon]

@0xEnleak HTB during work hours haha. Same tho 👀

[CyberSpooon @CyberSpooon]

@vxunderground put me in coach

[CyberSpooon @CyberSpooon]

The bug bounty x F1 crossover is insane

[Nagli @galnagli]

We found a way to access Max Verstappen's passport, driver's license, and personal information. Along with every other @Formula1 driver's sensitive data.

It took us 10 minutes using one simple security flaw 🧵

[CyberSpooon @CyberSpooon]

@0xEnleak Hell yeah 🤘🏻

[CyberSpooon @CyberSpooon]

@HackingLZ When I tell my non-cyber friends about this they look at me like I’m insane

[CyberSpooon @CyberSpooon]

@0xEnleak UAC is actually a super rad tool. Can get mem dumps with it too

[Wietze @Wietze]

🆕Recent additions to https://t.co/c2bs1AaVPZ:

• iscsicpl.exe for DLL exec+UAC bypass
• eudcedit.exe for UAC bypass
• reset.exe/change.exe/query.exe for proxy exec
• pixtool.exe/applauncher.exe/mpiexec.exe for dev tool proxy exec

⭐Nearly 8,000 GitHub stars - thank you all!